Uncategorized

Beware!! Hackers Distribute Amadey Malware Pushed via Software Cracks & Keygen Sites

Software cracks and keygen sites are used as bait to distribute the latest version of the Amadey Bot malware with the help of SmokeLoader malware.

The malware strain called Amadey was found over four years ago, and is capable of performing the following tasks:-

  • System reconnaissance
  • Stealing information
  • Loading additional payloads

Since 2020, there has been a steady decline in the prevalence of this malware. A new version of the virus has, however, been reported by the Korean researchers at AhnLab. 

SmokeLoader malware is also working in conjunction with this new version of the virus, which is also very old, but, still very active. Amadey’s shift away from Fallout and Rig exploit kits represents a significant departure from its previous strategy. 

Amadey’s new campaign

It is known that SmokeLoader makes use of software cracks or keygens to disguise itself, stimulating the victims to download and install the software voluntarily. 

When cracks and key generators are used, antivirus warnings are activated, making the user have to disable their antivirus program. The ease with which malware can be distributed, and makes them an ideal means for doing so.

It works by injecting its “Main Bot” into the process (explorer.exe) that is currently running on the system so that it becomes trusted by the OS and can download Amadey when it is executed.

The Amadey program automatically copies itself to the TEMP folder under the name “bguuwe.exe” once it has been downloaded and executed. With the help of the cmd.exe command, this creates a scheduled task that is responsible for maintaining persistence.

In the context of C2 communication, Amadey establishes contact with the threat actor’s server and sends a profile of the system to it. 

While the system profile includes the following information:-

  • OS version
  • Architecture type
  • Installed apps list
  • List of installed AV tools

To respond, the server delivers instructions to download further plugins, as well as info-stealer malware like RedLine, which is designed to steal personal information from the victims.

With the aid of the ‘FXSUNATD.exe’ tool, Amadey is able to bypass UAC or perform DLL hijacking in an effort to install payloads with elevated privileges.

It has been found that the latest version of Amadey, version 3.21, is capable of discovering 14 different antivirus products. 

Targeted & abused Emails, FTPs, VPN clients

Malware can access email accounts, FTP servers, and VPN clients, as well as a variety of other types of information. Several different software applications can be targeted with the info-stealing plug-in, including:-

  • Mikrotik Router Management Program Winbox
  • Outlook
  • FileZilla
  • Pidgin
  • Total Commander FTP Client
  • RealVNC, TightVNC, TigerVNC
  • WinSCP

Keep the following things in mind in order to avoid the dangers of Amadey Bot and RedLine:-

  • Make sure you don’t download cracked files.
  • Activators for software products should not be downloaded.
  • Downloading illegitimate key generators should be avoided.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Tags: Malware
Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

7 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

8 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

11 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

11 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

12 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

15 hours ago